Ransomware Protection for Small Business: Prevention, Backups and Response

It starts on a Monday morning. Files won’t open, every folder has a strange new extension, and a text note on the desktop demands payment in cryptocurrency. Your staff can’t invoice, schedule or reach customer records. For a small business, a few days like that can be devastating.

Ransomware is malware that encrypts your data, and often steals it first, then demands payment to restore access or keep the data private. The good news is that most of what works against it is affordable and well documented. This guide is built on the #StopRansomware Guide from the US Cybersecurity and Infrastructure Security Agency (CISA) and its partners, translated for a busy owner.

Why small businesses are targets

Attackers don’t need to pick you specifically. Many attacks are opportunistic: automated scans for unpatched servers, mass phishing campaigns, and stolen passwords bought in bulk. Small businesses often have fewer defenses, no full-time security staff and backups that haven’t been tested. That makes them attractive.

Attackers also reach small businesses through their IT providers. CISA lists third parties and managed service providers as an initial access vector. If you use an MSP, read our guide to choosing a managed IT service provider for the security questions to ask.

How ransomware gets in

CISA’s #StopRansomware Guide, last updated in 2023, organizes prevention around the main ways attackers get in:

• Internet-facing vulnerabilities and misconfigurations: unpatched VPNs, firewalls, remote desktop (RDP) exposed to the internet.
• Compromised credentials: reused or weak passwords, often without MFA.
• Phishing: emails with malicious links or attachments, or messages that trick staff into giving up logins.
• Precursor malware: an earlier infection that later delivers ransomware.
• Advanced social engineering: impersonating IT support or executives by phone, text or chat.
• Third parties and managed service providers: attackers abusing a trusted vendor’s access.

The prevention controls that matter most

You don’t need every tool on the market. Focus on the controls CISA highlights, starting at the top of this table.

Strong logins are the cheapest big win. Passkeys are a phishing-resistant option many platforms now support; our guide to passkeys explains how they work. For a wider security model, see zero trust security.

Backups: the 3-2-1 rule done right

Backups are what turn a ransomware attack from a crisis into a bad week. But CISA warns that many ransomware variants try to find and delete or encrypt accessible backups, so how you back up matters as much as whether you do.

CISA’s small business guidance describes the 3-2-1 rule:

• 3 copies of important data: the original plus 2 backups.
• 2 different types of storage media, such as a local drive and the cloud.
• 1 copy off-site.

Then make it ransomware-resistant:

1. Keep at least 1 copy offline or immutable. If your backup is always connected with the same credentials as your network, ransomware can reach it.
2. Encrypt backups so stolen copies are useless.
3. Back up the right things. Customer records, financial and employee data, email, configuration files and line-of-business databases.
4. Automate it. Manual backups get skipped.
5. Test restores on a schedule. CISA recommends testing full and partial restores and confirming you can roll back at least 7 days.
6. Know your targets. Set a recovery point objective (how much data you can lose) and recovery time objective (how long you can be down), and check that your backups meet them.

CISA also recommends keeping “golden images” of critical systems so you can rebuild them quickly.

Key takeaway: A backup you haven’t restored from is a hope, not a plan. Keep 1 copy offline, encrypt it, and test a restore before you need it.

Build an incident response plan before you need it

When ransomware hits, panic wastes hours. CISA recommends a written, tested incident response plan and communications plan. For a small business, 2 to 3 pages is enough if it covers:

• Who’s in charge, with backups for each role.
• Contact list: your IT provider, cyber insurer, lawyer, bank and key vendors, stored offline and on paper.
• How to isolate systems quickly.
• How to communicate if email is down.
• Reporting duties: law enforcement, insurers, and any state breach notification laws for customer data. Health businesses have extra duties under HIPAA.
• Recovery order: which systems come back first.

Practice it once a year with a short tabletop exercise.

Warning signs worth acting on

Attackers often spend time inside a network before they launch the encryption, stealing credentials and copying data so they can threaten to leak it. Catching them in that window can stop the attack. Tell staff and your IT provider to escalate these signs immediately:

• New administrator accounts nobody created.
• Antivirus or endpoint protection suddenly disabled on several devices.
• Logins at odd hours or from unfamiliar locations, especially on admin or remote access accounts.
• Large, unexpected uploads of data to outside services.
• Backups failing or being deleted.
• Many files being renamed or changing extensions at once.

If you have a managed provider, ask which of these they monitor for and how quickly they’ll call you. Make sure someone is actually watching alerts outside office hours, because attackers don’t keep office hours.

If you’re hit: the first steps

These steps follow CISA’s response checklist. Bring in professional help as soon as you can.

1. Isolate affected systems. Disconnect infected devices from the network and Wi-Fi. If you can’t disconnect them, power them down, but know that this can destroy evidence held in memory.
2. Protect your backups. Make sure backup systems are disconnected from the affected network.
3. Triage. Identify which systems are affected and prioritize the critical ones.
4. Preserve evidence. Keep logs, ransom notes and affected systems for investigators.
5. Report the incident. Contact CISA (cisa.gov/report), your local FBI field office or the FBI’s Internet Crime Complaint Center at ic3.gov. Law enforcement may know of a decryptor.
6. Call your insurer and lawyer if you have them, before making major decisions.
7. Find the entry point and close it, including disabling compromised accounts and resetting passwords.
8. Rebuild and restore from clean, offline backups, in priority order, without reinfecting systems.
9. Review and improve. Document what happened and fix the gaps.

Should you pay the ransom?

The FBI doesn’t support paying ransoms, and CISA’s guide says the same. Paying doesn’t guarantee you’ll get a working decryption key or that stolen data will be deleted, and it funds future attacks.

Payments can also carry legal risk. The US Treasury’s Office of Foreign Assets Control (OFAC) issued an updated advisory on September 21, 2021, warning that facilitating ransomware payments to sanctioned parties can violate US sanctions, and that reporting promptly to law enforcement and cooperating are mitigating factors. This is not legal advice; involve a lawyer before any decision about payment.

Report the attack whether or not you pay.

Where to start: a 30-day plan

If you’re using AI tools across the business, make sure they’re covered by the same access controls; our guide to generative AI for small business covers safe adoption.

Conclusion

Ransomware protection for a small business doesn’t require a big security budget. It requires the basics done consistently: MFA, patching, email filtering, least privilege, and offline backups you’ve actually tested. Add a short incident response plan and know who to call. Do those things, and ransomware becomes something you recover from, not something that ends your business.

Sources

• CISA: #StopRansomware Guide — initial access vectors, prevention best practices, offline encrypted backups, response checklist and reporting contacts
• CISA: Back Up Business Data — the 3-2-1 rule and restore testing for small businesses
• FBI: Ransomware — FBI position on paying ransoms and reporting
• FBI Internet Crime Complaint Center: Ransomware — where to report attacks
• US Treasury OFAC: Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments — sanctions risks and mitigating factors